Tony Arcieri

Another great article on this topic: The Tether Conundrum: A Quick Backstory - https://tonyarcieri.com/the-tether-conundrum > I, and many others, suspect Tether is being used to effectively counterfeit hundreds of millions of dollars of perceived value, which are being immediately reinvested into Bitcoin to keep it from collapsing.

I recommend considering a non-cryptocurrency startup that's doing similar work in decentralization and creating new protocols for internet architecture. See a short list here: https://decentralize.tech/ Blockchains get 80% of the conversation right -- we need fat protocols, new architectures, and new ways of doing things than traditional VC-controlled walled garden apps. But once the current Bitcoin bubble pops, I think that "blockchains" are going to sound extremely non-reputable to a lot of people and you'll likely regret the time you've put into it. If you're serious about core Blockchain-type engineering, I recommend looking at a couple of the projects outlined in this post: https://tonyarcieri.com/on-the-dangers-of-a-blockchain-monoculture

Lesspass is not notable for its approach; deterministic password managers have existed for quite some time. They're often recommended against, and it's dangerous to use one without a full understanding of the significant caveats. See https://tonyarcieri.com/4-fatal-flaws-in-deterministic-password-manage… the hacker news discussion, https://news.ycombinator.com/item?id=13016132, and notably the top comment there.

My bad, will edit accordingly. The in-browser, over-the-wire javascript crypto implementation still makes me nervous. I'd love to hear some compelling evidence to the contrary, but as I understand most of what has been stated before about in-browser crypto hasn't changed much [0]. [0] https://tonyarcieri.com/whats-wrong-with-webcrypto

> Heartbleed is a great example. It wasn't caused by an error with how C handles memory or strings or anything else. It was caused by failing to validate untrusted input. Rust isn't going to help you with that. I think you'll want to check your facts again: https://tonyarcieri.com/would-rust-have-prevented-heartbleed-another-l…

I'd recommend reading this article, which discusses some big problems with this approach to password management: https://tonyarcieri.com/4-fatal-flaws-in-deterministic-password-manage…

Not exactly. The current trend is towards the JVM, but not Java. I wrote about this last week: http://www.smashcompany.com/technology/the-jvm-is-part-of-a-world-wide… Even the cutting edge of Ruby is now on the JVM, as Rubyists see a need for threads and find jRuby the most convenient way to move forward: http://tonyarcieri.com/2012-the-year-rubyists-learned-to-stop-worrying… Rails took off in 2004 as a rebellion against the overly-heavy Java frameworks like Struts. But now what good ideas Rails offered have been incorporated into languages that run on the JVM, and a lot of innovation, in particular with concurrency, is happening on the JVM, and some of those things are areas where Ruby (other than JRuby) is weak.

> not all security is crypto Yes, but you started off talking about crypto so that's what I'm going to address... Unless you're a cryptographer (and even then), any time you're using any type of crypto the risk model in your head is probably going to be completely wrong. I recently blogged about this: http://tonyarcieri.com/all-the-crypto-code-youve-ever-written-is-proba… Unless you plan on becoming a crypto expert your best bet is leaving cryptography to the experts.

The problem with lists like this is they really are just a "here's 100 open source products", without any criteria or individual evaluation. It is often just parrots repeating what other parrots say. Something which is clearly alpha-state isn't usable to regular users shouldn't have a "recommendation". Then you get sub optimal recommendations, listing some projects which are unmaintained etc. With the cleanup at https://privacyguides.org, (since we split from PTIO) we've removed a lot of things, and gone down the part of actually providing guidance rather than "use this software to make you magically more private". I think it's important to think privately, modify behavior rather than rely on technology to do it all for you. Looking at this particular list there are some bad choices: - LessPass: We explicitly removed deterministic password managers https://github.com/privacyguides/privacyguides.org/pull/323, https://tonyarcieri.com/4-fatal-flaws-in-deterministic-password-manage… - AndOTP: Uses PBKDF2 and a heap of rounds that is unbelievably slow when you have a number of OTPs. Aegis uses Argon, which doesn't have this problem, and we think it's code is developed by someone who is security conscientious. - Qwant: https://github.com/privacyguides/privacyguides.org/pull/342#issue-1057… we removed due to "due to bad privacy policies data is collected and shared with third parties" - Silence: Unmaintained, uses SS7 network, should never be recommended. -…

> I don't really have the technical knowledge to evaluate it myself, and I suspect 99% of the people in HN are in the same position. Therefore, if I were to say "Signal's security is excellent" I would be falling for the cult of Moxie myself, not an informed opinion. Sure, but that's not what's happening when people whose day-to-day involve applied cryptography and/or application security are commenting on MTProto and Telegram. Here's a good read on why Telegram's "contest", which is a challenge meant to create the illusion of resilience, is totally bogus in the context of real-world cryptography: http://www.cryptofails.com/post/70546720222/telegrams-cryptanalysis-co… The things that the Signal Protocol does well: 1. It maximizes forward secrecy, 2. while working for mobile devices that may be offline or unreachable, 3. and uses authenticated encryption. https://tonyarcieri.com/all-the-crypto-code-youve-ever-written-is-prob… https://paragonie.com/blog/2015/05/using-encryption-and-authentication… Disclaimer: The last link (the paragonie.com one) was my writing on the subject.

For those interested in security in particular, we've outlined the opinions and design decisions here: https://github.com/linuxkit/linuxkit/blob/master/docs/security.md In short: Kernel Security Incubator - We want to push linux kernel security as much as possible. In service of that, we want linuxkit to be a place where leading-edge linux kernel security patches can land and incubate. Feature examples are Landlock, Wiregurd, okernel, etc. We'll also incubate KSPP and container hardening improvements, like hardening the kernel eBPF JIT and namespacing the IMA subsystem. Modern and Securely Configured Kernels - Latest kernel, following all KSPP recommendations. Minimal Base - No extra dependences, just what's needed to run containerd. Absolutely no package manager. Type Safe, Containerized System Daemons - many linux privescs happen due to escalations using root system daemons. These daemons should be written in typesafe language like OCaml and Rust. We have an Ocaml dchpcd and look to invite more. If you're convinced by https://tonyarcieri.com/it-s-time-for-a-memory-safety-intervention?utm… linuxkit is a place to contribute to the solution. Built With Hardened Toolchains and Containers - uses notary signing for all dependencies and intermediate builds, uses musl libc for hardened libc implementation + hardened compiler options for building system packages. Immutable Infrastructure -…

In the case of LibreSSL, it's probably not going to happen very soon; the OpenBSD devs are very much C programmers (and Ted Unangst already addressed this in the case of Heartbleed, though his methodology is the subject of some contention: http://www.tedunangst.com/flak/post/heartbleed-in-rust ). While Ted's post has been criticized by a few Rust programmers (see: http://tonyarcieri.com/would-rust-have-prevented-heartbleed-another-lo… ), it still brings up the argument that one's language choice isn't a magic bullet. There's an adage (I have no idea who originated it) that's along the lines of "every 'idiot-proof' system underestimates an idiot's ability to break things", and that's worth considering here. Rust prevents a lot of bugs, but it's not a guarantee of security. One needs to understand the actual problem that needs solved, and this is where the OpenBSD devs are focusing with LibreSSL (and their various other projects); their security track record stands as a good testament of that notion of understanding trumping language choice. This isn't to say that I disagree with you. Rust is readily poised to replace C in a lot of contexts (IIRC, one of the obstacles right now is the use of a different allocator, so trying to use a Rust library from C results in some performance overhead), and it would be nice to see it used in a lot more projects. Just bear in mind that moving to Rust isn't the only step that would be required to fix these sorts of security bugs.

4) So they can redirect all users to a non-HTTPS site. That's interesting. What youre saying is ridiculous, it's nothing to do with "completely" trustless, you're not trustworthy at all. The "we promise we wont serve malicious code" is the same securi Basically your users have to trust: -You -Your staff -Cloudflare -Google -Any computer used to design, build or login to your web app -Anyone with access to any of these computers -Every single CA in existence (including the US and Chinese government) -Anyone with resources to spoof a CA SHA-1 signature (anyone with ~$700,000 [0]) -The authors of the JS OTR library and any other code you use Do you see the problem here? There are literally millions of people in your trust chain. Libpurple sucks, but browsers are the #1 target for exploit writers, not to mention the HUGE attack surface they pose. There are just so many angles of attack for your service. Anything hosted on a shared server is not secure. The word cloud and security should not be in the same sentence. No offense, but you guys really do not seem like cryptography experts and there are so many pitfalls here that I would not recommend trying to promote this until you completely re-design everything. As far as WebCrypto.. I'm just going to leave this here: http://tonyarcieri.com/whats-wrong-with-webcrypto http://matasano.com/articles/javascript-cryptography/ [0] https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html

Deterministic password managers have their caveats: https://tonyarcieri.com/4-fatal-flaws-in-deterministic-password-manage…

See how this could have just as well been done in Rust: https://tonyarcieri.com/would-rust-have-prevented-heartbleed-another-l… Mind you, I am of the firm belief that C is at fault for many of the security vulnerabilities, but this is not one of them.

Tether has looked like a scam for years. Here's a post from 2018 about it: https://tonyarcieri.com/the-tether-conundrum

> Sure, but malleability that has a close to zero chance of being a problem. https://efail.de https://tonyarcieri.com/all-the-crypto-code-youve-ever-written-is-prob… This isn't even a controversy among cryptographers or cryptography engineers.

If I'm reading this right it's in-browser JS signing software. The author makes the claim that native software is hard to audit, but neglects the much bigger problem of having to verify the JS downloaded on-demand for every session. What you are served is not guaranteed to be the same as what's hosted on GitHub. Tony Arcieri explains the issues more broadly here https://tonyarcieri.com/whats-wrong-with-webcrypto Also, Nadim Kobeissi formalized it wrt Protonmail a while ago: https://eprint.iacr.org/2018/1121.pdf

There's earlier (from 2018) Tether criticism: http://www.tetherreport.com/ https://tonyarcieri.com/the-tether-conundrum

I think the use of an enum (in the Rust example) makes this a sum type situation: https://tonyarcieri.com/a-quick-tour-of-rusts-type-system-part-1-sum-t…

https://medium.com/coinmonks/untethered-tether-new-developments-f28c02… https://tonyarcieri.com/the-tether-conundrum-part-2-the-plot-thickens

>That means the hashing needs to be done client side, probably with JavaScript. Is there any safe way to do that? No [0,1...n]. Note that these articles are about encryption, but the arguments against javascript encryption apply to hashing as well. Also consider that no one logs this stuff accidentally to begin with. If the entity controlling the server and writing the code wants to log the passwords, they can rewrite their own javascript just as well as they can whatever is on the backend. There's nothing to be done about people undermining their own code. [0]https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2011/a… [1]https://tonyarcieri.com/whats-wrong-with-webcrypto

I don't think I know enough to feel a particular way about it. All I know is that some people I respect seem to dislike it[0][1], so I've just defaulted to avoiding it where I can. [0] https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2011/a… [1] https://tonyarcieri.com/whats-wrong-with-webcrypto

@bascule addresses deterministic password managers as a category here: https://tonyarcieri.com/4-fatal-flaws-in-deterministic-password-manage… Certainly you’ve considered these points, and I’m interested in hearing your responses to these points if you’re using this scheme yourself and want others to use it. I’m particularly interested in point 4 where, unlike traditional password managers like 1Password and Lastpass, where you need both the password and some form of data access, the leakage of my master password (say by a shoulder surfing security camera at any time) literally means every credential can be derived from scratch at any time.

You should use 1Password or "pass" or, if a glutton for punishment, KeePassX, and honestly, I think you should use them to the exclusion of all other password managers. You can lower your security with a bad password manager. I agree with everything Tony Arcieri wrote about deterministic password managers here: https://tonyarcieri.com/4-fatal-flaws-in-deterministic-password-manage… Before you consider a deterministic password manager, just use "pass".

A better argument against deterministic password generators than the current replies to your post is that if you have to change your password on a given site - due to password expiration, ‘forgot password’, security breaches, etc. - you have to change the seed, and remember which seed you’re using for which site. There are some others: https://tonyarcieri.com/4-fatal-flaws-in-deterministic-password-manage… But if you want to use one anyway, that blog post links to a bunch of them.

Disclaimer: stateless/deterministic password managers have some serious flaws compared to stateful/vault password managers. See https://tonyarcieri.com/4-fatal-flaws-in-deterministic-password-manage… for example

This is a long blog post that talks about some drawbacks of this approach: https://tonyarcieri.com/4-fatal-flaws-in-deterministic-password-manage… Before reading this I was convinced that stateless deterministic approaches like these was the ideal. But some arguments in that post changed my mind.